CVE-2026-105386: SQL Injection in onetwothreeneth HospitalManagementSystem

This vulnerability affects the onetwothreeneth HospitalManagementSystem up to commit 9ef91ed6007314b6473110ed699dff76d158f61d. The issue is in the get function of print.php, where the transaction_id parameter is not properly sanitized, enabling remote SQL injection attacks. The rolling release nature of the product means no discrete version numbers are available to specify affected or fixed versions. The vulnerability was reported to the project early but no fix or response has been provided. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to perform SQL injection via the transaction_id parameter. This can lead to unauthorized data access or manipulation within the HospitalManagementSystem database. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a patch is released, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the transaction_id parameter in print.php. Avoid exposing the vulnerable endpoint to untrusted networks if possible.